Hosted searching of private local area network information

CROSS-REFERENCE TO RELATED APPLICATIONS

0001The present application is a continuation of U.S. application Ser. No. 11/982,542, filed Nov. 2, 2007, the disclosure of which is incorporated by reference herein.

FIELD

0002Embodiments of the invention relate to the field of hosted searching; and more specifically, to the hosted searching of private local area network (LAN) information.

BACKGROUND

0003One method of searching is performed over the World Wide Web (WWW). This type of searching is commonly referred to as web searching and is normally performed by a search engine. The term search engine is used to refer to an information retrieval system designed to help find information stored on a computer system. Search engines help to minimize the time required to find information and the amount of information which is subsequently consulted. One type of conventional search engines are Web search engines that search for information on the public WWW. Other types of conventional search engines may include enterprise search engines that search on private intranets, personal search engines, and mobile search engines. Typically, search engines provide an interface to enable users to specify criteria about an item of interest and have the engine find the matching items within the stored information. The items of interest of interest are typically documents and the criteria are the words or concepts that the document may contain. A document, as used herein, is a bounded physical representation of a body of information designed with the capacity to communicate information. Documents may be digital files in various formats, including web pages, word processing documents, images, or the like.

0004One prior art technique of Web search engine is to use a Web crawler. A web crawler, also known as a web spider, web robot or web bot, is a program or automated script which browses the WWW in a methodical, automated manner. This process is called web crawling or spidering. Many search engines uses spidering as a means of providing up-to-date data. Web crawlers are mainly used to create a copy of all the visited pages for later processing by the search engine that will index the downloaded pages to provide fast searches. A web crawler typically starts with a list of Uniform Resource Locator (URL), and upon visiting these URLs, the web crawler identifies all hyperlinks in the page and adds them to the list of URLs to visit. These URLs can be recursively visited according to a set of policies. By indexing collected documents, or metadata about the documents, the search engine can provide a set of matching items quickly. For example, a library search engine may determine the author of each book automatically and add the author name to a description of each book. Users can then search for books by the author's name. The metadata collected about each item (e.g., document) is typically stored in the form of an index. The index provides a way for the search engine to calculate the relevance, or similarity, between the search query and the set of items.

0005A limitation of this prior art method is that the collected information is a copy of the entire document, and the index is organized according to the collected documents, such as by the metadata that corresponds to the document. As a result, this prior art method has the disadvantages of processing the entire collected documents, such as to extract or generate metadata related to the collected documents, and organizing the document information (e.g., metadata) according to documents, not according to the items of interest.

0006Another prior art technique of a personal search engine is to use a desktop search tool. A desktop search tool is a tool that searches the contents of a user's own computer files, rather than searching other computers, or searching the Internet. These tools are designed to find information about documents on the user's computer, including web browser histories, e-mail archives, text documents, audio files, images, video, or the like. The search index for the desktop search tool resides on the user's computer. The search index is also organized according to the documents, not according to the items of interest.

0007A limitation of this prior art method is that the desktop search tool only collects information from a user's computer, not other computers. Another limitation of this prior art method is that the desktop search tool only collects information on the user's computer and does not discover other devices from which to collect information. As a result, this prior art method has the disadvantage of being limited in the types of information sources from which to collect information and the types of information that can be collected.

BRIEF SUMMARY

0008In one embodiment, an apparatus for hosted searching of different private LAN information includes a LAN crawler to automatically and repeatedly crawl a LAN having multiple devices, and a hosted on-demand search system including a set of one or more centralized-search servers. The LAN crawler includes a collection module to attempt to collect, from across multiple disparate information sources stored in the multiple devices, only the parts of the disparate information sources that include descriptive information of a first set of one or more items of interest. The LAN crawler includes a reporting module to automatically report the collected information organized according to the first set of items of interest out of a firewall of the private LAN being crawled and over the Internet. The set of one or more centralized-search servers includes a crawler interface to receive the reports of different instances of the LAN crawler deployed on the multiple private LANs, at least some of which are operated by different entities, and a database interface to create and synchronize a separate private search database for each of the private LANs based on the received reports. Each of the private search databases includes the collected information that is not organized by documents located on the private LANs, by the first set of items of interest. The set of one or more centralized-search servers also includes a server user interface module to provide a user interface over the Internet to each of the private LANs to perform private searches of their corresponding private search database. The set of one or more centralized-search servers also includes a configuration database coupled to the server user interface module to store authentication information for access by the user interfaces and search queries.

BRIEF DESCRIPTION OF THE DRAWINGS

0009The invention may best be understood by referring to the following description and accompanying drawings that are used to illustrate embodiments of the invention. In the drawings:

0010<figref idref="DRAWINGS">FIG. 1</figref> illustrates an exemplary hosted on-demand search system coupled to multiple private LANs over a network according to one embodiment of the invention;

0011<figref idref="DRAWINGS">FIG. 2</figref> illustrates an exemplary private LAN having a LAN crawler deployed on a client device according to one embodiment of the invention;

0012<figref idref="DRAWINGS">FIG. 3</figref> illustrates exemplary information sources stored on the multiple devices of the private LAN according to one embodiment of the invention;

0013<figref idref="DRAWINGS">FIG. 4</figref> illustrates an exemplary reorganization module of the centralized-search server according to one embodiment of the invention;

0014<figref idref="DRAWINGS">FIG. 5</figref> illustrates an exemplary flow diagram of the LAN crawler of the client device according to one embodiment of the invention;

0015<figref idref="DRAWINGS">FIG. 6</figref> illustrate an exemplary flow diagram of a private search according to one embodiment of the invention;

0016<figref idref="DRAWINGS">FIG. 7</figref> illustrates an exemplary flow chart of operations between the client device and the hosted on-demand search system according to one embodiment of the invention;

0017<figref idref="DRAWINGS">FIG. 8</figref> illustrates exemplary user interface pages of the user interface on the client device according to one embodiment of the invention;

0018<figref idref="DRAWINGS">FIG. 9</figref> illustrates an exemplary embodiment of a private search database that is a hierarchical database that stores the collected information in a tree structure according to one embodiment of the invention; and

0019<figref idref="DRAWINGS">FIG. 10</figref> illustrates exemplary search syntaxes for searching a hierarchical database according to one embodiment of the invention.

DETAILED DESCRIPTION

0020The following description describes methods and apparatus for hosted searching of different private LAN information. In the following description, numerous specific details such as logic implementations, opcodes, operations, hardware of software modules, code, and types and interrelationships of system components are set forth in order to provide a more thorough understanding of the present invention. It will be appreciated, however, by one skilled in the art that the invention may be practiced without such specific details. In other instances, control structures, gate level circuits and full software instruction sequences have not been shown in detail in order not to obscure the invention. Those of ordinary skill in the art, with the included descriptions, will be able to implement appropriate functionality without undue experimentation.

0021References in the specification to “one embodiment”, “an embodiment”, “an example embodiment”, etc., indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

0022In the following description and claims, the terms “coupled” and “connected,” along with their derivatives, may be used. It should be understood that these terms are not intended as synonyms for each other. Rather, in particular embodiments, “connected” may be used to indicate that two or more elements are in direct physical or electrical contact with each other. “Coupled” may mean that two or more elements are in direct physical or electrical contact. However, “coupled” may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other.

0023A method and apparatus for hosted searching of different LAN information is described. In one embodiment, an apparatus for hosted searching of different private LAN information includes a LAN crawler to automatically and repeatedly crawl a LAN having multiple devices, and a hosted on-demand search system including a set of one or more centralized-search servers.

0024In another embodiment, the LAN crawler includes a collection module to attempt to collect, from across multiple disparate information sources stored in the multiple devices, only the parts of the disparate information sources that include descriptive information of a first set of one or more items of interest. In another embodiment, the parts are collected from multiple information sources. In another embodiment, the LAN crawler includes a reporting module to automatically report the collected information organized according to the first set of items of interest out of a firewall of the private LAN being crawled and over the Internet. In another embodiment, the LAN crawler includes an organization module to automatically organize the collected information according to the rust set of items of interest.

0025In another embodiment, the set of one or more centralized-search servers includes a crawler interface to receive the reports of different instances of the LAN crawler deployed on the multiple private LANs, at least some of which are operated by different entities, and a database interface to create and synchronize a separate private search database for each of the private LANs based on the received reports. Each of the private search databases includes the collected information that is not organized by documents located on the private LANs, but by the first set of items of interest. In another embodiment, the set of one or more centralized-search servers also includes a server user interface module to provide a user interface over the Internet to each of the private LANs to perform private searches of their corresponding private search database. In another embodiment, the set of one or more centralized-search servers also includes a configuration database coupled to the server user interface module to store authentication information for access by the user interfaces and search queries,

0000Hosted On-Demand Search System

0026<figref idref="DRAWINGS">FIG. 1</figref> illustrates an exemplary hosted on-demand search system <b>100</b> coupled to multiple private LANs <b>101</b>, <b>102</b>, and <b>103</b> over a network <b>130</b> according to one embodiment of the invention. The hosted on-demand search system <b>100</b> is coupled to private LANs <b>101</b>, <b>102</b>, and <b>103</b> over the network <b>130</b>, for example, the Internet. The private LANs may be owned and operated by different entities, such as different users, organizations, companies, or the like. For example, LAN <b>101</b> may be owned by a first company, and the LANs <b>102</b> and <b>103</b> are owned by a separate company, or alternatively, the LANs <b>101</b> may all be owned by separate companies. Each of the private LANs <b>101</b>, <b>103</b>, and <b>103</b> includes user interfaces (UI) <b>110</b>(<b>1</b>), <b>110</b>(<b>2</b>), and <b>110</b>(<b>3</b>), respectively, and multiple devices <b>115</b> (only illustrated in private LAN <b>101</b> for ease of illustration). In one embodiment, the user interfaces <b>110</b>(<b>1</b>), <b>110</b>(<b>2</b>), and <b>110</b>(<b>3</b>) are browser-based UIs that allow a user to retrieve the information from the corresponding private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>), respectively. The private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>) are data repositories that store the information collected by the LAN crawlers <b>111</b>(<b>1</b>), <b>111</b>(<b>2</b>), and <b>111</b>(<b>3</b>), respectively. Using the user interfaces <b>110</b>(<b>1</b>), <b>110</b>(<b>2</b>), and <b>110</b>(<b>3</b>), users can query the collected information stored in the private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>), respectively, to get search results. The user interfaces <b>110</b>(<b>1</b>), <b>110</b>(<b>2</b>), and <b>110</b>(<b>3</b>) can display the search results in tree, chart, list, table, formats, as well as other types of formats.

0027The multiple devices <b>115</b> may include a server, a directory server, a workstation, a network printer, a switch, a router, or other electronic devices that can be part of a private LAN. Also, deployed on the private LANs <b>101</b>, <b>102</b>, and <b>103</b>, are LAN crawlers <b>111</b>(<b>1</b>), <b>111</b>(<b>2</b>), <b>111</b>(<b>3</b>), respectively. A LAN crawler is an automated script which explores the devices <b>115</b> of each of the private LANs in a methodical, automated manner. The LAN crawler automatically and repeatedly crawls the devices <b>115</b> of the private LAN to collect, from across multiple disparate information sources stored on the devices <b>115</b>, descriptive information of items of interest. The LAN crawler collects from multiple disparate information sources, only those parts of the disparate information sources that include descriptive information of the first set of items of interest, instead of copying the entire information source. The LAN crawler of each of the private LAN may be deployed on a client device, such as a client workstation. Alternatively, the LAN crawler may be deployed on one of the devices <b>115</b> of the private LAN. In one embodiment, the LAN crawler and the UI for each of the private LANs resides on the same client device. Alternatively, the LAN crawler and UI for each of the private LANs may reside on separate devices. It should be noted that the LAN crawler is different from a web crawler (also referred to as a web spider, web robot, or web bot), which is a program or automated script which browses the World Wide Web in a methodical, automated manner in order to create a copy of all the visited pages for later processing by a search engine that indexes the downloaded pages.

0028Although only illustrated in the LAN crawler <b>111</b>(<b>1</b>), each of the LAN crawlers <b>111</b>(<b>1</b>), <b>111</b>(<b>2</b>), and <b>111</b>(<b>3</b>) includes a collection module <b>112</b> and a reporting module <b>113</b>. The collection module <b>112</b> attempts to collect, from across each of the disparate information sources, the descriptive information of the items of interest. In one embodiment, the descriptive information is collected from a single information source. In another embodiment, the descriptive information is collected from multiple information sources. The reporting module <b>113</b> automatically reports the collected information. In one embodiment, the reporting module <b>113</b> automatically reports the collected information organized according to the items of interest out of a firewall of the private LAN being called and over the Internet. In one embodiment, the reporting module <b>113</b> is configured to send the reports periodically over the Internet. In another embodiment, the reporting module <b>113</b> is configured to send the information once collected. Alternatively, the reporting module <b>113</b> may be configured to send the report on a scheduled basis. In one embodiment, the reports include corresponding time-stamped data with the collected information to indicate the time at which the information is collected. Alternatively, the reports do not include time-stamped data.

0029In another embodiment, each of the LAN crawlers also includes an organization module <b>114</b>. The organization module <b>114</b> automatically organizes the collected information according to the items of interest. In one embodiment, the collection module <b>112</b> attempts to collect the descriptive information through a set of one or more organize questions to the devices <b>115</b> of the private LAN being crawled. In response to the set of one or more organize questions the collection module <b>112</b> receives values from the devices <b>115</b>, including the descriptive information of the items of interest. In one embodiment, the organized questions are request inquiries with defined names that extract values that correspond to the defined names. The defined names and corresponding values are name-value pairs that can be stored in the private search database <b>121</b>. When the collection module <b>112</b> asks the questions in an organized manner, the collected information is implicitly organized for the reports that are sent by the reporting module <b>113</b>. For example, it may be important to know the different between a computer named “Tetris” and installed software name “Tetris.” Because the LAN crawler <b>111</b> knows how it collected the information for each item (e.g., using the organized questions), including how to identify the computer which has the name, the network to which that computer belongs, and the identity of the computer which has the software installed, the two items similarly named items can be distinguished by its organization in the collected information. Similarly, the collected information may be stored in the private search database using this organization. In another embodiment, the collection module <b>112</b> collects information that is not implicitly organized, and sends the unorganized information to the organization module <b>114</b> to be organized for the reports that are sent by the reporting module <b>113</b>. In either case, the reporting module <b>113</b> generates one or more reports to send to the collected information to the hosted on-demand search system <b>100</b>.

0030The hosted on-demand search system <b>100</b>, which is coupled to the network <b>130</b> (e.g., Internet), includes a set of one or more centralized-search servers <b>120</b> (one centralized-search server has been illustrated. The centralized-search server <b>120</b> includes a private search database that corresponds to each of the private LANs. For example, the centralized-search server <b>120</b> includes private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>), which correspond to private LANs <b>101</b>, <b>102</b>, and <b>103</b>, respectively. A search database is a collection of records or data that is stored in a data repository of a computer system so that a computer program or person using a search query language can consult it to answer search queries. The centralized-search server <b>120</b> includes a database interface <b>122</b> which creates and synchronize the separate private search databases <b>121</b>(<b>1</b>), <b>1</b>(<b>2</b>), and <b>121</b>(<b>3</b>) for each of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>, respectively.

0031In one embodiment, the database interface <b>122</b> is a database management system (DBMS), which is used to manage and query the search database. In one embodiment, the database interface <b>122</b> is implemented in code. The central concept of a database is that of a collection of records, or pieces of information. Typically, for a given database, there is a structural description of the type of pieces of information held in that database; this description is known as a schema. The schema describes the objects that are represented in the database, and the relationships among them. There are a number of different ways of organizing a schema, that is, of modeling the database structure; these are known as database models. There are various types of database models, such as, for example, relational models, flat models, hierarchical models, network models, object-relational models, object models, entity-relationship models, associative models, concept-oriented models, entity-attribute-value models, semi-structured models, extensible markup language (XML) database models, or the like. The model in most common use is the relational model, which represents all information in the form of multiple related tables, each including rows, and columns. This model represents relationships by the use of values common to more than one table. Other models such as the hierarchical model and the network model use a more explicit representation of relationships. The hierarchical model is organized into a tree-like structure. The structure allows repeating information using parent/child relationships: each parent can have many children but each child only has one pa nt. In one embodiment, the private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>) is a hierarchical database, as described in more detail below. Alternatively, in other embodiments, the private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>), are other types of databases.

0032Each of the private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>) includes the collected information, which is collected from across the disparate information sources of a private LAN being crawled. The collected information in each of the private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>) is organized according to the items of interest, and not by documents located on the private LANs. It should be noted conventional search engines organize the collected information according to the collected documents, not the items of interest.

0033The centralized-search server <b>120</b> also includes a crawler interface <b>123</b> that receives the reports from the reporting module <b>113</b> of the different instances of the LAN crawler (e.g., <b>111</b>(<b>1</b>), <b>111</b>(<b>2</b>), and <b>111</b>(<b>3</b>)) deployed on the different private LANs <b>101</b>, <b>102</b>, and <b>103</b>. The crawler interface <b>123</b> distinguishes the reports from the different instances of the LAN crawler deployed on the different private LANs to identify in which private search database a particular report is to be stored, and sends the distinguish reports to the database interface <b>122</b> to be stored in the identified search database (e.g., search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>)). In one embodiment, the crawler interface <b>123</b> distinguishes the reports by sending an identifier of the received report to a configuration database <b>125</b>, and receives the identified search database that corresponds to the identifier from the configuration database <b>125</b>. The identifier identifies the entity that operates the particular LAN from which the report was received. The identifiers for each of the private LANs may be inserted into the reports by the respective LAN crawler.

0034The centralized-search server <b>120</b> also includes a server user interface (UI) module <b>124</b> that is coupled to the database interface <b>122</b>, crawler interface <b>123</b>, and configuration database <b>125</b>. The server UI module <b>124</b> is configured to provide a user interface <b>110</b> over the Internet to each of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>, to allow users to perform private searches of their corresponding private search database <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>), respectively. In one embodiment, the server UI module <b>124</b> receives a search query from a user of the private LAN <b>101</b> to perform a private search of the corresponding private search database <b>121</b>(<b>1</b>). These servers UI module <b>124</b> performs a search in the search database <b>121</b>(<b>1</b>) through the database interface <b>122</b> using the search query. In one embodiment, the server UI module <b>124</b> is configured to store the search query in the configuration database <b>125</b> for later retrieval by the user. The user may designate the search query as being shareable. When the search query is designated as shareable, the server UI module <b>124</b> stores the search query, but not the search results of the private search, and designates the saved search query as shareable, allowing for display and selection of the shareable search query on the user interfaces <b>110</b>(<b>1</b>), <b>110</b>(<b>2</b>), and <b>110</b>(<b>3</b>) of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>, respectively. However, when the search query is not designated as shareable, the server UI module <b>124</b> stores a search query and only allows for display and selection of the stored search query on the user interface <b>110</b>(<b>1</b>) of the private LAN <b>101</b> from which the search query originated.

0035The centralized-search server <b>120</b> also includes the configuration database <b>125</b> that is coupled to the crawler interface <b>123</b> and the server user interface module <b>124</b>. In addition to storing the search queries as described above, the configuration database <b>125</b> may also store authentication information for access by the user interfaces <b>110</b>(<b>1</b>), <b>110</b>(<b>2</b>), and <b>110</b>(<b>3</b>). The configuration database <b>125</b> also stores the identifiers to identify the source of the received reports in order to distinguish each of the reports for each of the private LANs from which the reports originated. Table 1 includes exemplary types of information that are stored in the configuration database <b>125</b>.

0036<tables id="TABLE-US-00001" num="00001"><table frame="none" colsep="0" rowsep="0"><tgroup align="left" colsep="0" rowsep="0" cols="3"><colspec colname="offset" colwidth="14pt" align="left" /><colspec colname="1" colwidth="70pt" align="left" /><colspec colname="2" colwidth="133pt" align="left" /><thead><row><entry /><entry namest="offset" nameend="2" rowsep="1">TABLE 1</entry></row><row><entry /><entry namest="offset" nameend="2" align="center" rowsep="1" /></row><row><entry /><entry>Type of Information</entry><entry>Description of Information</entry></row><row><entry /><entry namest="offset" nameend="2" align="center" rowsep="1" /></row></thead><tbody valign="top"><row><entry /><entry>Users</entry><entry>User authentication information</entry></row><row><entry /><entry>Companies</entry><entry>Companies which to which the users</entry></row><row><entry /><entry /><entry>belong</entry></row><row><entry /><entry>Demographics</entry><entry>Demographic information collected from</entry></row><row><entry /><entry /><entry>users</entry></row><row><entry /><entry>Crawlers</entry><entry>Information about crawler operation</entry></row><row><entry /><entry>Dashboards</entry><entry>A dashboard is a collection of dashboard</entry></row><row><entry /><entry /><entry>panels each of which display information</entry></row><row><entry /><entry /><entry>from saved search queries</entry></row><row><entry /><entry>Saved Search Queries</entry><entry>A search query which has been saved by a</entry></row><row><entry /><entry /><entry>user and optionally designated as</entry></row><row><entry /><entry /><entry>shareable</entry></row><row><entry /><entry>Search Histories</entry><entry>Search history for each user</entry></row><row><entry /><entry namest="offset" nameend="2" align="center" rowsep="1" /></row></tbody></tgroup></table></tables><br /> The exemplary types of information of Table 1 include users, demographics, LAN crawlers, dashboards, saved search queries, and search histories. The user-type information may include user authentication information that is used to authenticate the user, such as when the user requests the user interface <b>110</b>(<b>1</b>) from the server user UI module <b>124</b>. The demographic-type information may include demographic information collected from each of the users of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>, respectively. The crawler-type information may include information about the crawler operations on the particular LAN crawlers of each of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>. The dashboard-type information includes information regarding a collection of dashboard panels. A dashboard is a graphical user interface (GUI) widget that can be part of the user interface <b>110</b>(<b>1</b>), and can be configured and saved by the user to display search results in various forms for saved search queries. For example, the user interface <b>110</b>(<b>1</b>) may include a page that displays various components, as well as the dashboard. Alternatively, the page may include a dashboard that includes one or more dashboard panels. Each of the dashboard panels may include updated search results for separate saved search queries. For example, a user may have separate dashboard panel for displaying search results in the form of a list, a chart, or a table, as described in more detail below. The collection of dashboard panels may include saved configurations of the dashboard on each of the user interfaces <b>110</b>(<b>1</b>), <b>110</b>(<b>2</b>), and <b>110</b>(<b>3</b>). For example, the user may save the configuration of a dashboard with a saved search query so that when the user logs in, the dashboard may be displayed with updated search results for the saved search query without having to manually enter the search query again.

0037Also, the configuration database <b>125</b> may also store other types of information, such as saved search queries and search histories. The saved search query may be saved by a user and optionally designated as shareable to be shared with other users of other private LANs. It should be noted that although a search query is designated as shareable, only the saved search queries are shared, not the search results from the saved search queries. The search history type information includes search histories for each of the users. It should be noted that Table 1 includes exemplary types of information that may be stored in the configuration database <b>125</b>, hut in other embodiments, the database <b>125</b> may store other types of information.

0038In another embodiment, the hosted on-demand search system <b>100</b> includes a classification server <b>140</b> coupled to a classification database <b>141</b>. The classification server <b>140</b> may attempt to identify devices <b>115</b> that are discovered on the private LANs <b>101</b>, <b>102</b>, and <b>103</b>. The classification server <b>141</b> is configured to compare the collected information of the private search databases <b>121</b>(<b>1</b>), <b>121</b>(<b>2</b>), and <b>121</b>(<b>3</b>) against predetermined characteristics of own devices stored in the classification database <b>141</b>, and to compute a classification metric for the multiple devices <b>115</b> of the private LAN <b>101</b>, <b>102</b>, and <b>103</b>. For example, the classification server <b>140</b> may evaluate the collected information by comparing the collected information against “fingerprints” of known devices stored in the classification database <b>141</b>, comparing the media access control (MAC) address (of the collected information) to ranges of MAC addresses for known devices stored in the classification database <b>141</b>, or the like. Then using either the fingerprint comparison or the MAC address lookup, or both, classification server <b>140</b> determines a classification for the discovered devices of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>. The classification server <b>140</b> can evaluate the collected information and determine a classification for the discovered devices and notify the administrator of the private LAN of the device classification, or modify the collected information in the private search database <b>121</b> to include the device classification. By using the classification server <b>140</b> and classification database <b>141</b>, it is possible to collect information from many different networks, and thus a large set of different devices. It is also possible to classify an unknown, discovered device <b>115</b> on the private LAN; especially, when the LAN crawler deployed on the private LAN is unable to report certain classification information (e.g., vendor, model, or the like) to the hosted on-demand search server <b>120</b>. In one embodiment, the classification server <b>140</b> and classification database <b>141</b> are the classification server and classification database, developed by Network Chemistry of Palo Alto, Calif. The classification server and classification database developed by Network Chemistry may be implemented according to the various embodiments described in U.S. patent application Ser. No. 11/803,004, filed May 10, 2007, entitled “Collaborative Device Classification.” Alternatively, the classification server <b>140</b> and classification database <b>141</b> are other types of classification servers and classification databases. The distribution module <b>127</b> is configured to distribute copies of the LAN crawler to be installed on devices. For example, through the user interface, a user visiting a website hosted by the company or organization that manages the hosted on-demand search system <b>100</b>, may click on a link to download the LAN crawler to the user's computer to be installed and executed.

0039<figref idref="DRAWINGS">FIG. 2</figref> illustrates an exemplary private LAN <b>101</b> having a LAN crawler deployed on a client device <b>200</b> according to one embodiment of the invention. The LAN crawler <b>111</b> of the client device <b>200</b> automatically and repeatedly collects information from multiple devices <b>115</b> of the private LAN <b>101</b> out of a firewall <b>220</b> of the private LAN <b>101</b> being crawled and over the Internet <b>130</b> to the centralized-search server <b>120</b>. In particular, the LAN crawler <b>111</b> automatically and repeatedly collects information from disparate information sources <b>203</b> that are stored on the multiple devices <b>115</b>. Each of the devices <b>115</b> may store one or more information sources <b>203</b>. As described above, the reporting module <b>113</b> automatically records the collected information, which is organized according to the items of interest, out of the firewall <b>220</b>. In one embodiment, the reporting module <b>113</b> communicates with the crawler interface <b>123</b> over the Internet through a router <b>210</b> and the firewall <b>220</b>. A router is a computer networking device that interconnects separate logical subnets. A router is a computer whose software and hardware are usually tailored to the tasks of routing and forwarding, generally containing a specialized operating system (e.g. Cisco's IOS or Juniper Networks JunOS or Extreme Networks XOS), RAM, NVRAM, flash memory, and one or more processors. A router may also manage a pool of Internet Protocol (IP) addresses and may have information about client configuration parameters such as the default gateway, the domain name, the Domain name system (DNS) servers, other servers, or the like. A firewall is a hardware or software device which is configured to permit, deny, or proxy data through a computer network which has different levels of trust. Routers and firewalls of private LANs are known to those of ordinary skill in the art, and accordingly, a detailed description regarding routers and firewalls has not been included so as to not obscure the embodiments of the present invention. It should also be noted at the user interface <b>110</b> communicates with the server UI module <b>124</b> of the centralized-search server <b>120</b> over the Internet <b>130</b> through the router <b>210</b> and firewall <b>220</b>.

0040In one embodiment, the collection module <b>112</b> of the LAN crawler <b>111</b> includes a discovery module <b>201</b>, and a probing module <b>202</b>. The discovery module <b>201</b> automatically discovers the devices <b>115</b> of the private LAN <b>101</b> being crawled by the LAN crawler <b>111</b>. The probing module <b>202</b> attempts to collect data on each of the information sources <b>203</b> stored in the discovered devices <b>115</b> of the private LAN <b>101</b>. The probing module <b>202</b> may be configured to collect data from information sources <b>203</b> according to a set of probing requirements. The set of probing requirements may include a set of one or more organized questions. The collection module <b>112</b> asks the set of one or more questions of the information sources <b>203</b> of the devices <b>115</b>, and receives values in response to the set of organized questions from the information sources <b>203</b>. The values include descriptive information regarding the items of interest. In another embodiment, the set of probing requirements may include other types of requests to collect information from the devices <b>115</b>. As described above, when the collection module asks organized questions, the LAN crawler <b>111</b> may not need an organization module to organize the collected information according to the items of interest, since the collected information is implicitly organized by the use of organized questions. Alternatively, the LAN crawler <b>111</b> may include an organization module <b>114</b> that organizes the collected information according to the items of interest before being reported over the Internet <b>130</b> by the reporting module <b>113</b>.

0041In one embodiment, the LAN crawler <b>111</b> is coupled to a data store <b>230</b> (e.g., a memory, a database, or the like) in which the LAN crawler <b>111</b> stores configuration information for the particular LAN crawler <b>111</b>. In one embodiment, the configuration information may include the set of probing requirements for the LAN crawler <b>111</b>, such as a set of one or more organized questions. Alternatively, the configuration information stored in the data store <b>230</b> includes additional LAN crawler configuration information. In another embodiment, the LAN crawler configuration for each of the LAN crawlers is stored in the configuration database <b>125</b>.

0042In general, the LAN crawler <b>111</b> discovers devices <b>115</b> on the private LAN <b>101</b> and collects information from the discovered devices <b>115</b>. The LAN crawler <b>111</b> collects, from across multiple disparate information sources <b>203</b> stored in the devices <b>115</b>, only those parts of the disparate information sources <b>203</b> that include descriptive information of the first set of items of interest. In one embodiment, for at least one item of interest, the parts are collected from multiple disparate information sources. In one embodiment, the LAN crawler <b>111</b> is deployed on the client device <b>200</b>. For example, the LAN crawler <b>111</b> can be software operating on a processor of the client device <b>200</b>.

0043In one embodiment, the descriptive information of the first set of items of interest include, in general, technical information regarding the private LANs <b>101</b>, <b>102</b>, and <b>103</b>, user of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>, and the multiple devices <b>115</b> of each of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>. Each of the LAN crawlers <b>111</b>(<b>1</b>), <b>111</b>(<b>2</b>), and <b>111</b>(<b>3</b>), is configured to collect values of the technical information from the multiple information sources <b>203</b> stored on the devices <b>115</b> through a set of one or more organized questions to the devices <b>115</b> of the private LAN being crawled.

0044Information Technology (IT) or Information and Communications Technology (ICT), as defined by the Information Technology Association of America (ITAA), is the study, design, development, implementation, and support or management of computer-based information system, particularly software applications and computer hardware. IT deals with the use of electronic computers and computer software to convert, store, protect, process, transmit, and retrieve information, securely. IT professionals, such as network administrators, perform a variety of duties that range from installing applications to designing complex computer networks and information databases, such as data management, networking, engineering computer hardware, database and software design, as well and the management and administration of entire systems or networks. In one embodiment, the technical information is IT information that is used by an IT professional in performing a variety of duties, such as those described above, for the study, design, development, implementation, and support or management of computer-based information systems, particularly software applications and computer hardware. Some examples of descriptive IT information include, but are not limited to, information in configuration files in routers, switches, firewalls, asset lists, information in Lightweight Directory Access Protocol (LDAP) servers (described below), personal computer configuration information in a registry, a Windows Management Instrumentation (WMI) database (described below), and/or a directory, physical and logical network topology information, flow information, raw packet contents, log information from all devices, networks, and systems. Alternatively, the descriptive information of the first set of items of interest may include other types of information other than technical information, such as financial information, enterprise information, or the like.

0045Network and host security solutions and network management applications are specialized repositories of information that operate independently and without information sharing. More advanced technology leads to more specialization, which makes it even more difficult to share information between systems or devices. Attempts to integrate this information, such as security information managers (SIM), or configuration management databases (CMDB), lead to even more specialization as they limit the resolution of information that they will receive and process—e.g., only receiving alerts from support intrusion detection systems (IDSs), which detects unwanted manipulations to systems, or only parsing configuration from supported routers. The embodiments described herein may allow a user to more easily find technical information, such as network management information and relationships within and between disparate systems or devices, which may help the user to solve network management and security problems. The embodiments described herein may also allow a user to find related items of interest, even when the items of interest originate from disparate information sources, such as devices employing different data models. A data model is an abstract model that describes how data is represented and used.

0046More specifically, in other embodiments, the technical information may include information regarding existence of the devices <b>115</b> within each of the private LANs <b>101</b>, <b>102</b>, and <b>103</b>. The devices <b>115</b> may include one or more routers, one or more switches, one or more servers, one or more directory servers, one or more workstations, or the like. The technical information may also include information regarding existence of multiple hardware modules within each of the devices <b>115</b>, states of the hardware modules, properties of the hardware modules, configuration of the hardware modules, history of the hardware modules. The technical information may also include information regarding existence of any peripherals coupled with the devices <b>115</b>, states of the peripherals, properties of the peripherals, configuration of the peripherals, history of the peripherals. The technical information may also include information regarding existence of at least one operating system operating within each of the devices <b>115</b>, state of the operating systems, properties of the operating systems, configuration of the operating systems, history of the operating systems. The technical information may also include information regarding existence of software within each of the devices <b>115</b>, state of the software, properties of the software, configuration of the software, history of the software. The technical information may also include information regarding presence of users using each of the devices <b>115</b>, an inventory of users that are authorized to use each of the devices <b>115</b>, policies assigned to the users for each of the devices <b>115</b>, and history of each user's actions regarding each of the devices <b>115</b>.

0047For example in one embodiment of the invention the data stored in the private search database includes information regarding substantially all devices within a private LAN, a list of software installed on those devices, and a list of users authorized to use those devices. Additionally, the data stored may include information regarding the operating system version installed on substantially all devices within the private LAN, the software which is running on substantially all devices within the private LAN, and a configuration file from at least one router, switch, or firewall within the private LAN. The devices may include substantially all workstations within a private LAN, substantially all routers within the private LAN, substantially all switches within the private LAN, substantially all servers within the private LAN, substantially all firewalls within the private LAN, and substantially all directory servers within the private LAN.

0048The disparate information sources <b>203</b> may include, for example, a routing table of a router, a router configuration file of a router, an ARP table of a switch, a bridging table of a switch, a switch configuration table of a switch, a software configuration file of a server, a resource utilization counter of a server, a log file of a server, custom application file of a server, user information of a directory server, group information of a directory server, a software configuration file of a workstation, a registry of a workstation, an operating system interface database of a workstation, a directory of a workstation, a resource utilization counter of a workstation, a log file of a workstation, a configuration file of a network printer, or the like. Alternatively, other technical information may be collected from other types of information sources than those listed above.

0049In another embodiment, the technical information is collected from the registry of a device running the WINDOWS® operating system, available from Microsoft®. In another embodiment, the technical information is collected from a WMI database of a device running Microsoft WINDOWS. In another embodiment, the technical information is collected from the “/proc directory” of a device running a UNIX-like operating system (e.g., Linux). In another embodiment, the technical information is collected from a directory service (e.g., residing on a directory server using LDAP. LDAP is an application protocol for querying and modifying directory services, running over Transmission Control Protocol and Internet Protocol (TCP/IP), LDAP tends to use DNS names for structuring the objects of the directory service. In another embodiment, the technical information is collected from a networking device, for example, a router or a switch, using the Simple Network Management Protocol (SNMP), Telnet, Secure Shell (SSH) protocols, or the like. In another embodiment, the technical information is collected from a network printer using SNMP or the like. Alternatively, the technical information may be collected from other devices that are part of the private LAN.

0050In one embodiment, the technical information is collected by the LAN crawler <b>111</b> asking a set of one or more organized questions of the disparate information sources <b>203</b>, described above, which are stored in the devices <b>115</b> of the private LAN being crawled. In response to the set of organized questions, the LAN crawler <b>111</b> receives values of the technical information from the disparate information sources stored on the devices <b>115</b>.

0051There are several techniques that may be employed to discover the devices <b>115</b> on the private LAN. These techniques fall generally into two main categories: passive traffic collection, and active scanning.

0052Passive traffic collection entails operating in a promiscuous mode in order to observe all broadcast and non-broadcast network traffic, such as Ethernet traffic. In this technique, device MAC addresses are gathered and the source IP address is recorded if the packet in question is an IP or address resolution protocol (ARP) packet. For active scanning the following techniques can be used: 1) ARP Scanning, 2) Ping Scanning, and 3) CAM Table Scanning.

0053In ARP Scanning, the local network segment is probed by issuing ARP requests to each possible IP address within the system's broadcast domain. The upper and lower bounds for the addresses to query are determined by examining the network and broadcast addresses of the network adapter used by the LAN crawler <b>111</b> to perform the scanning activity. If an ARP reply is received, then a device at the queried IP address exists.

0054Ping Scanning involves sending an Internet Control Message Protocol (ICMP) echo request (a Ping packet) to a single IP address or a range of addresses. If a device is utilizing one of the IP addresses to which a Ping was sent, the device responds with an ICMP echo reply packet. Thus it can be determined if a device <b>115</b> exists at an arbitrary IP address.

0055Cam Table Scanning involves interrogating the network's switching infrastructure for the MAC addresses of the devices connected to it. This may be done via SNMP. This enables the LAN crawler <b>111</b> to quickly gather MAC addresses for all devices <b>115</b> on the private LAN without the need for the LAN crawler <b>111</b> to be on the same network segment. As described above, the classification server <b>140</b> is configured to classify the devices <b>115</b>. For example, the organizationally unique identifiers (Mils) which form the first 24-bits of the MAC address can be compared against those that belong to a particular manufacture. For example, the OUI of the MAC address can be compared with those that belong to a manufacture of wireless or wired access points (APs).

0056Some other techniques that can be used to collect information about the devices <b>115</b> of the private LAN are, for example: <ul id="ul0001" list-style="none"><li id="ul0001-0001" num="0000"><ul id="ul0002" list-style="none"><li id="ul0002-0001" num="0057">1) Passive operating system detection: A device's operating system can be determined remotely by observing key fields in the TCP/IP packets that it emits.</li><li id="ul0002-0002" num="0058">2) TCP &amp; UDP port scanning: APs often run at least a handful of remotely accessible services. By cataloging the services found on a particular model of AP it is possible to determine what devices appear similar to it.</li><li id="ul0002-0003" num="0059">3) IP protocol scanning: Even if a different revision of an AP model uses the same operating system it may support different IP protocols.</li><li id="ul0002-0004" num="0060">4) Service interrogation: Many APs provide services used to configure them. This technique involves interrogating the services an AP may be running in order to gather information that may differentiate it from another device.</li><li id="ul0002-0005" num="0061">5) SNMP queries: Some APs provide SNMP management capabilities. SNMP queries are used to glean any information that may uniquely identify a device.</li><li id="ul0002-0006" num="0062">6) Promiscuous mode detection: If the device is in promiscuous mode then it may be a network bridge. APs may be network bridges.</li><li id="ul0002-0007" num="0063">7) NAT (Network Address Translation) device detection: If the device is performing NAT, then it may be an AP/router. Wireless AP/routers act as NAT gateways for the hosts connected to them.</li><li id="ul0002-0008" num="0064">8) Dynamic Host Configuration Protocol (DHCP) Client Identification: This identifies default hostnames and options that are unique to the DHCP client implementations used in off-the-shelf wireless AP/routers.</li></ul></li></ul>

0065Additionally, the device's manufacturer may be determined by the OUI of its MAC address. This information is gathered during normal network communication with the device <b>115</b>.

0066In one embodiment, the LAN crawler <b>111</b> is configured to collect the same information as described in the U.S. patent application Ser. No. 11/803,004, filed May 11, 2006, entitled “Collaborative Device Classification,” In another embodiment, the LAN crawler <b>111</b> is configured to collect the same, similar, and/or dissimilar information than the information described in the U.S. patent application Ser. No. 11/803,004. For example, in addition to, or in place of, the information collected by the scan agent, the LAN crawler <b>111</b> is configured to attempt to collect information from other types of information sources, such as a WMI database.

0067A WMI database is a type of operating system interface database. WMI specifically is a set of extension to the WINDOWS Driver Model that provides an operating system interface through which instrumented components provide information and notification. WMI allows scripting languages like VBScript or WINDOWS POWERSHELL®, available from Microsoft, to manage personal computers and servers that are running WINDOWS, both locally and remotely. The contents of the WMI database may include make and model information for the hardware of the device, hardware configuration of the device, technical support ID information, list of installed programs, information about logged in users, information about running programs, and/or resource utilization information (e.g., CPU, memory, and disk utilization).

0068In addition to collecting information from a WMI database, the LAN crawler <b>111</b> is configured to collect information from other operating system interface databases, such as Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards, available from the Distributed Management Task Force (DMTF).

0069<figref idref="DRAWINGS">FIG. 3</figref> illustrates exemplary information sources <b>300</b> stored on the multiple devices <b>115</b> of the private LAN according to one embodiment of the invention. The multiple private LAN devices <b>115</b> include the client device <b>200</b> that is running the instance of the LAN crawler <b>111</b> (e.g., workstation), the router <b>210</b>, a switch <b>310</b>, a server <b>320</b>, a directory server <b>330</b>, a first workstation <b>340</b>, a network printer <b>350</b>, and a second workstation <b>360</b>. The information sources <b>300</b> are disparate information sources (e.g., <b>301</b>-<b>326</b>) that are stored on the LAN devices <b>115</b>. In this embodiment, the router <b>210</b> includes a routing table <b>301</b> and a routing configuration <b>302</b>. The routing table <b>301</b>, also referred to as a Routing Information Base (RIB), is an electronic table (e.g., stored in a file) or database type object that is stored in the router <b>210</b>. The routing table <b>301</b> stores the routes (and in some cases, metrics associated with those routes) to particular network destinations. The routing table <b>301</b> may also include information regarding the topology of the private LAN. The routing configuration <b>302</b> is an electronic table (e.g., stored in a file) or database type object that is stored in the router <b>210</b>. The routing configuration <b>302</b> may include router configuration information, such as how to automate assignment of IP addresses, subnet masks, default gateway, and other IP parameters, such as firewall rules, or the like. It should be noted that the format of the routing configuration <b>302</b> depends on the manufacturer of the router <b>210</b>. For example, in a router developed by Cisco Systems Inc. the routing configuration <b>302</b> is expressed as a series of commands; a new router can be set up with the same configuration by entering the series of commands into a command line interface of the new router. As such, the routing configuration <b>302</b> in the Cisco Systems' router may be more like a file. In other embodiments, the routing configuration <b>302</b> is available through SNMP. In these embodiments, the routing configuration <b>302</b> is stored more like a database.

0070In one embodiment, the LAN crawler <b>111</b> collects descriptive information from the router <b>210</b> using SNMP. Alternatively, the LAN crawler <b>111</b> may collect the descriptive information from the router <b>210</b> using other protocols, such as Telnet, SSH protocols, or the like.

0071In this embodiment, the switch <b>310</b> includes an Address Resolution Protocol (ARP) table <b>303</b>, a bridging table <b>304</b>, and switch configuration <b>305</b>. A switch, also referred to as a network switch, is a computer networking device that connects network segments. Network switches are capable of inspecting data packets as they are received, determining the source and destination device of that packet, and appropriately forwarding the packet to the intended connected device. Switches of private LANs are known to those of ordinary skill in the art, and accordingly, a detailed description regarding switches has not been included so as to not obscure the embodiments of the present invention. The ARP table <b>303</b> is a table used for finding a host's hardware address when only the host's network layer address is known. ARP is a standard method for resolving many different network-layer protocol addresses to hardware addresses, and may be used to translate IP addresses to MAC addresses. The ARP table <b>303</b> may also include information regarding Token Rings, Fiber Distribution Date Interface (FDDI), IEEE 802.11, IP over ATM, or the like. The switch configuration <b>305</b> may store other configuration information related to the switch <b>310</b>.

0072In one embodiment, the LAN crawler <b>111</b> collects descriptive information from the switch <b>310</b> using SNMP. Alternatively, the LAN crawler <b>111</b> may collect the descriptive information from the switch <b>310</b> using other protocols, such as Telnet, Secure Shell (SSH) protocols, or the like.

0073In this embodiment, the server <b>320</b> includes various disparate information sources, such as software configuration files <b>306</b>, resource utilization counters <b>307</b>, log files <b>308</b>, and custom application files <b>309</b>. The software configuration files <b>306</b> may include information regarding the software that is installed and/or running on server <b>320</b>, for example, the type and version of the operating system, and/or the types and versions of other types of software. It should be noted that the software configuration information may be stored in other information sources than software configuration files.

0074The resource utilization counters <b>307</b> may include the actual resource utilization values of the server <b>320</b>. The resource utilization may include, for example, central processing unit (CPU) performance of one or more processors, input-output (I/O) performance, memory performance, or the like. The resource utilization counters <b>307</b> may be hardware performance counters (also referred to as hardware counters), which are a set of special-purpose registers of a processor to store the counts of hardware-related activities within the computer system. Alternatively, the resource utilization counters <b>307</b> may be software performance counters that read the values from set of special-purpose registers of the processor. Alternatively, the resource utilization values may be stored in log files, WINE database, or in other types of Ides stored on the sever <b>320</b>.

0075The log files <b>308</b> may include time-based log information of the server <b>320</b>. The time-based log information may be sequentially or chronologically recorded in the log files <b>308</b>. The log files <b>308</b> may include recorded events to provide an audit trail that can be used to diagnose problems. For example, some operating systems provide a “syslog” service, which allows the filtering and recording of log message to be performed by a separate dedicated subsystem, rather than each application recording log message. “Syslog” is a standard for forwarding log message in an IP network. The “syslog” service can be used to integrate log data from many different types of systems into a central repository.

0076The custom application files <b>309</b> may include information regarding applications that are currently installed and/or running on the server <b>320</b>. In one embodiment, custom applications can be developed for exclusive use by the server <b>320</b>. The custom application file <b>309</b> may include information that is specific to custom applications. For example, a Manufacturing Resource Planning (MRP) application may provide the number of transactions per section it is processing through an application interface (API). The LAN crawler <b>111</b> could collect specific information, such as transactions per second, from the MRP application through an API.

0077In one embodiment, the LAN crawler <b>111</b> collects descriptive information from the server <b>320</b> using Hypertext transfer protocol (HTTP). Alternatively, the LAN crawler <b>111</b> may collect the descriptive information from the server <b>320</b> using other protocols, such as Representational State Transfer (REST), Remote Procedure Call (RPC), Simple Object Access Protocol (SOAP), SNMP, SSH, WMI, COBRA, Distributed Component Object Model (DCOM), or the like.

0078In this embodiment, the directory server <b>330</b> is an information source that includes user information <b>311</b> and/or group information <b>312</b>. The directory server <b>330</b> may be a device that executes one or more software applications that store and organize information about users, groups of users, and/or network resources. The directory server <b>330</b> may be used by a network administrator to manage users' access to the resources. The directory server <b>330</b> may also store a directory database that holds information about names to objects that are managed in the directory service. The directory server <b>303</b> may store such information as, for example, names of users, names of groups of users, permission sets associated with the users, permission sets associated with the groups of users, or the like. The directory service may be a shared information infrastructure for locating, managing, administrating, and organizing common items and network resources, which can include volumes, folders, files, printers, users, groups, devices, telephone numbers, and other objects. For example, the directory service may be used to obtain a list of available computers and the information for accessing them. The directory server <b>303</b> may also define the namespace for the network. A namespace a namespace in this context is the term that is used to hold one or more objects as named entries. The directory service has a set of rules that determine how network resources are named and identified. The rules specify that the names be unique and unambiguous. The name is called the distinguished name (DN) and is used to refer to a collection of attributes, such as relative distinguished names, which make up the name of a directory entry.

0079In one embodiment, the LAN crawler <b>111</b> collects descriptive information from the directory service on the directory server <b>330</b> using LIMP. Alternatively, the LAN crawler <b>111</b> collects descriptive information from the directory server <b>330</b> using other protocols, such as protocols used in Active Directory, Remote Authentication Dial In User Service (RADIUS), or the like. Active Directory is an implementation of directory services for use with devices running WINDOWS operating system. Active Directory may provide central authentication and authorization services for WINDOW-based computers, and may allow administrators to assign policies, deploy software, and apply updates to an organization. Active Directory stores information and settings in a central database. The RADIUS protocol is an authentication, authorization, and accounting protocol for applications such as network access or IP mobility.

0080In this embodiment, the first workstation <b>340</b> includes various information sources, such as software configuration files <b>313</b>, resource utilization counters <b>314</b>, log files <b>315</b>, directories <b>316</b> (e.g., “/proc directory) of the first workstation <b>340</b>. The first workstation <b>340</b> is a device that is running a UNIX or UNIX-like operating system, such as Linux. A UNIX-like operating system is one that behaves in a manner similar to a UNIX system, while not necessarily conforming to or being certified to any version of the Single UNIX specification. The software configuration files <b>313</b> may include information regarding the software that is installed and/or running on first workstation <b>340</b>, for example, the type and version of the operating system (e.g., Linux), and/or the types and versions of other types of software, as described above with respect to the software configuration files <b>306</b>. The resource utilization counters <b>314</b> may include the actual resource utilization values of the first workstation <b>340</b>, as described above with respect to the resource utilization counters <b>307</b>. The log files <b>315</b> may include time-based log information of the first workstation <b>340</b>, as described above with respect to the log files <b>308</b>.

0081The directories <b>316</b> may include, for example, the “/proc directory.” The “/proc directory” is a file or a directory of files containing information about all the CPUs and memories in the system, such as the numbers used to identify each logical CPU, the vender identifications used to identify the CPU manufacturer, the numbers given to identify the CPU family or manufacturing process, information about the current state of the system's computer memory (including virtual memory and the cache), or the like. On workstations that are running Linux, the “/proc directory” may substitute or compliment information contained in the resource utilization counters <b>314</b>.

0082In one embodiment, the LAN crawler <b>111</b> collects descriptive information from the first workstation <b>340</b> using SSH. Alternatively, the LAN crawler <b>111</b> may collect the descriptive information from the first workstation <b>340</b> using other protocols, such as telnet. SNMP, syslog, HTTP, or the like.

0083In this embodiment, the network printer <b>350</b> includes various information sources, such as a configuration file <b>317</b>, software configuration files <b>318</b>, resource utilization counters <b>319</b>, log files <b>321</b>, or the like. The software configuration files <b>318</b>, resource utilization counters <b>319</b>, log files <b>321</b> are similar to those described above with respect to the server <b>320</b> and first workstation <b>340</b>. The configuration file <b>317</b> includes information about the network printer, such as the name of the network printer <b>350</b>, the IP address of the network printer <b>350</b>, configuration settings of the network printer <b>350</b>, or the like.

0084In one embodiment, the LAN crawler <b>111</b> collects descriptive information from the network printer <b>350</b> using SNMP. Alternatively, the LAN crawler <b>111</b> may collect the descriptive information from the network printer <b>350</b> using other protocols, such as HTTP, Telnet, or the like.

0085In this embodiment, the second workstation <b>360</b> includes various information sources, including registry <b>322</b>, WMI database <b>323</b>, software configuration files <b>324</b>, resource utilization counters <b>325</b>, and log files <b>326</b>. Registry <b>322</b> is a directory which stores setting and options for the operating system. The registry <b>322</b> may contain information and settings for all the hardware, operating system software, most non-operating system software, users, preferences of the device (e.g., personal computer (PC)), or the like. For example, registry <b>322</b> is the Microsoft Registry for the WINDOWS operating system. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in the registry <b>322</b>. The registry <b>322</b> also provides a window into the operation of the kernel, exposing runtime information such as performance counters and currently active hardware. In another embodiment, the information that is obtained from the registry may also be obtained from other non-Windows mechanisms, such as Sysfs and procfs, which expose runtime information through the file system.

0086As described above, the WMI database <b>323</b> is a type of operating system interface database. The contents of the WMI database <b>323</b> may include make and model information for the hardware of the device, hardware configuration of the device, technical support ID information, list of installed programs, information about logged in users, information about running programs, and/or resource utilization information (e.g., CPU, memory, and disk utilization).

0087In another embodiment, the WMI database <b>323</b> may be other operating system interface databases, such as Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards, from the Distributed Management Task Force (DMTF), or the like.

0088The software configuration files <b>324</b> may include information regarding the software that is installed and/or running on second workstation <b>360</b>, for example, the type and version of the operating system (e.g., WINDOWS), and/or the types and versions of other types of software, as described above with respect to the software configuration files <b>306</b>. The resource utilization counters <b>325</b> may include the actual resource utilization values of the second workstation <b>360</b>, as described above with respect to the resource utilization counters <b>307</b>. The log files <b>326</b> may include time-based log information of the second workstation <b>360</b>, as described above with respect to the log files <b>308</b>.

0089In one embodiment, the LAN crawler <b>111</b> collects descriptive information from the second workstation <b>360</b> using WMI. Alternatively, the LAN crawler <b>111</b> may collect the descriptive information from the second workstation <b>360</b> using other protocols, such as server message block (SMB), DCOM, SNMP, or the like.

0090TABLE 2 includes exemplary information sources, and the corresponding first set of items of interest.

0091<tables id="TABLE-US-00002" num="00002"><table frame="none" colsep="0" rowsep="0" pgwide="1"><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="1" colwidth="133pt" align="left" /><colspec colname="2" colwidth="126pt" align="left" /><thead><row><entry namest="1" nameend="2" rowsep="1">TABLE 2</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row><row><entry>Information Sources:</entry><entry>First set of items of Interest:</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row></thead><tbody valign="top"><row><entry>For each Private LAN</entry><entry>List of all device connected to a network</entry></row><row><entry>For each network device information like:</entry><entry>IP address</entry></row><row><entry /><entry>MAC Address</entry></row><row><entry /><entry>Open TCP and UDP ports</entry></row><row><entry /><entry>Responses to probes on TCP and User</entry></row><row><entry /><entry>Datagram Protocol (UDP) ports</entry></row><row><entry /><entry>Dynamic Host Configuration Protocol</entry></row><row><entry /><entry>(DHCP) request contents</entry></row><row><entry /><entry>Domain Name System (DNS) names of</entry></row><row><entry /><entry>the devices</entry></row><row><entry>For each devices running Microsoft</entry><entry>List of installed programs (content of the</entry></row><row><entry>Windows operating system, collected</entry><entry>Window registry)</entry></row><row><entry>information like:</entry><entry>Installed program configuration (content</entry></row><row><entry /><entry>of the Window's registry)</entry></row><row><entry /><entry>Operating System Configuration (content</entry></row><row><entry /><entry>of the Window's registry)</entry></row><row><entry /><entry>Names of users who have logged into the</entry></row><row><entry /><entry>device (content of the Window's registry)</entry></row><row><entry /><entry>Invalid Configurations which might have</entry></row><row><entry /><entry>been created by spyware, adware or</entry></row><row><entry /><entry>malicious programs (content of the</entry></row><row><entry /><entry>Window's registry)</entry></row><row><entry /><entry>Hardware Configuration of the device</entry></row><row><entry /><entry>(content from Windows Management</entry></row><row><entry /><entry>Instrumentation (WMI))</entry></row><row><entry /><entry>Make and model information for the</entry></row><row><entry /><entry>hardware (content from WMI)</entry></row><row><entry /><entry>Technical support ID information (content</entry></row><row><entry /><entry>from WMI)</entry></row><row><entry /><entry>List of installed programs (content from</entry></row><row><entry /><entry>WMI)</entry></row><row><entry /><entry>Information about logged in users (content</entry></row><row><entry /><entry>from WMI)</entry></row><row><entry /><entry>Information about running programs</entry></row><row><entry /><entry>(content from WMI)</entry></row><row><entry /><entry>Resource utilization information</entry></row><row><entry /><entry>including, e.g., CPU, memory, and disk</entry></row><row><entry /><entry>utilization (content from WMI)</entry></row><row><entry /><entry>Resource utilization information</entry></row><row><entry /><entry>including, e.g., CPU, memory, and disk</entry></row><row><entry /><entry>utilization (from performance counters)</entry></row><row><entry>For each devices running Unix-like</entry><entry>Resource utilization information</entry></row><row><entry>operating system, collected information like:</entry><entry>including, e.g., CPU, memory, and disk</entry></row><row><entry /><entry>utilization (e.g., content from/proc</entry></row><row><entry /><entry>directory, performance counters, etc)</entry></row><row><entry /><entry>List of installed programs</entry></row><row><entry /><entry>Installed program configuration</entry></row><row><entry /><entry>Information about logged in users</entry></row><row><entry /><entry>Information about running programs</entry></row><row><entry>For each devices supporting SNMP (e.g.,</entry><entry>Interface utilization statistics</entry></row><row><entry>switches and routers), collected</entry><entry>ARP tables</entry></row><row><entry>information like:</entry><entry>Bridging Tables</entry></row><row><entry /><entry>Routing Tables</entry></row><row><entry /><entry>Other information contained in SNMP</entry></row><row><entry /><entry>Management Information Bases (MIBs)</entry></row><row><entry>For each devices supporting telnet or SSH</entry><entry>Detailed device configuration files</entry></row><row><entry>interfaces with command line interfaces</entry><entry>Bridging tables</entry></row><row><entry>(e.g., Cisco IOS based devices), collected</entry><entry>Routing tables</entry></row><row><entry>information like:</entry></row><row><entry>For each directory server (e.g., devices</entry><entry>List of users and groups in the network</entry></row><row><entry>using protocols such as LDAP or Active</entry><entry>Contact information for users</entry></row><row><entry>Directory), collected information like:</entry><entry>Group membership information for users</entry></row><row><entry /><entry>Login history information for users</entry></row><row><entry /><entry>List of other resources in network, such as</entry></row><row><entry /><entry>servers and databases</entry></row><row><entry>For each device, log information, saved to</entry><entry>User login history</entry></row><row><entry>log files or forwarded using syslog, like:</entry><entry>Firewall log information</entry></row><row><entry /><entry>Mail server history</entry></row><row><entry /><entry>Application error log</entry></row><row><entry>For each web server, collected information</entry><entry>The number of hits to the website</entry></row><row><entry>like:</entry><entry>Number of sales, click-through rate, or</entry></row><row><entry /><entry>other sales metrics</entry></row><row><entry>For each device, collected information</entry><entry>Number of meetings scheduled</entry></row><row><entry>from other internal systems (e.g.,</entry><entry>Pipeline value</entry></row><row><entry>Customer Relationship Management</entry></row><row><entry>(CRM) Systems), like:</entry></row><row><entry>For each application on a device, collected</entry><entry>Up-time of the application</entry></row><row><entry>information like:</entry><entry>Number of transactions processed</entry></row><row><entry /><entry>Number of active connections</entry></row><row><entry /><entry>Average transaction time</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row></tbody></tgroup></table></tables>

0092<figref idref="DRAWINGS">FIG. 4</figref> illustrates an exemplary reorganization module <b>126</b> of the centralized-search server <b>120</b> according to one embodiment of the invention. In this embodiment, the database interface <b>122</b> includes the reorganization module <b>126</b>. The reorganization module <b>126</b> is configured to reorganize the collected information by adding items of interest to the collected information stored in the corresponding search database <b>121</b>, to reorganize the existing items of interest stored in the corresponding search database <b>121</b>, to rename existing items of interests stored in the corresponding search database <b>121</b>, or the like. In one embodiment, the reorganization module <b>126</b> is part of the database interface <b>122</b>. Alternatively, the reorganization module <b>126</b> may be implemented in a separate module, or in other modules of the hosted on-demand search system <b>100</b>.

0093The reorganization module <b>126</b> includes a report scanning module <b>401</b>, an integration module <b>402</b>, and a renaming module <b>403</b>. The report scanning module <b>401</b> is configured to attempt to collect, from across the disparate reports received from the private LAN being crawled, descriptive information of other items of interest (also referred to as second set of one or more items of interest). The integration module <b>402</b> is configured to integrate the collected descriptive information that is organized according to the second set of items of interest into the corresponding private search database <b>121</b>. The integration module <b>402</b> can extract descriptive information of the second set of items of interest from the reports that include the descriptive information of the first set of items of interest, and integrate the extracted information into the private search database <b>121</b> to be organized according to the second set of items of interest in addition to, or in place of, the descriptive information that is organized according to the first set of items of interest when received from the crawler interface <b>123</b>. For example, TABLE 3 includes exemplary second set of items of interest that can be created from the first set of items of interest received in the reports from the LAN crawlers.

0094<tables id="TABLE-US-00003" num="00003"><table frame="none" colsep="0" rowsep="0"><tgroup align="left" colsep="0" rowsep="0" cols="2"><colspec colname="1" colwidth="91pt" align="left" /><colspec colname="2" colwidth="126pt" align="left" /><thead><row><entry namest="1" nameend="2" rowsep="1">TABLE 3</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row><row><entry>Second</entry><entry /></row><row><entry>Set of Items of Interest</entry><entry>Description of How Created</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row></thead><tbody valign="top"><row><entry>Network topology information</entry><entry>Interconnection of devices 115 on the</entry></row><row><entry /><entry>private LAN deduced from the</entry></row><row><entry /><entry>information in routing and bridging</entry></row><row><entry /><entry>information collected by the LAN crawler</entry></row><row><entry /><entry>111</entry></row><row><entry>Estimated device vendor and</entry><entry>Device vendor and model for devices 115</entry></row><row><entry>model for devices which do</entry><entry>deduced from classification server 140</entry></row><row><entry>not report this information</entry></row><row><entry>Security Audit</entry><entry>Information reported by the LAN crawler</entry></row><row><entry /><entry>111 is analyzed for security of</entry></row><row><entry /><entry>configuration and for security incidents</entry></row><row><entry /><entry>and the security posture of the private</entry></row><row><entry /><entry>LAN is summarized in a report</entry></row><row><entry>Software License Audit</entry><entry>Information about installation applications</entry></row><row><entry /><entry>is summarized so it can be compared with</entry></row><row><entry /><entry>the number of licenses owned for each</entry></row><row><entry /><entry>software application</entry></row><row><entry>Threshold Alerting</entry><entry>Resource utilization information, such as</entry></row><row><entry /><entry>disk usage, is compared with thresholds</entry></row><row><entry /><entry>and if the thresholds are exceeded then the</entry></row><row><entry /><entry>user is notified</entry></row><row><entry namest="1" nameend="2" align="center" rowsep="1" /></row></tbody></tgroup></table></tables>

0095In other embodiments, other types of second set of items of interest can be created from the first set of items of interest received in the reports from the LAN crawlers.

0096In another embodiment, the report scanning module <b>401</b> and the integration module <b>402</b> are used to reorganize the collected information according to a different organization, such as organized according to the created items of interest that are derived from the first set of items of interest.

0097The renaming module <b>403</b> is configured to rename similar items having different terminology to have a common terminology for searching purposes. The report scanning module <b>401</b> attempts to identify from among the first set of items of interest, received in the reports, similar items having different terminology. The renaming module <b>403</b> renames the similar items to have the common terminology. The integration module <b>402</b> integrates the collected information of the reports and the renamed similar items into the corresponding search database <b>121</b>. For example, a workstation running WINDOWS may include a “network adapter” to communicate with other devices <b>115</b>, while a workstation running Linux may include a “network interface” to communicate with other devices. When searching the private search database <b>121</b>, a user may provide a search query for all “network interfaces” of the private LAN to be displayed to show the available network interfaces or network adapters that communicate with other devices. Without reorganizing the collected information using the renaming module <b>403</b>, the search results may not include the “network adapters,” even though the user intended the search query to include the “network adapters.” The renaming module <b>403</b> can rename the collected “network adapter” information to be named as “network interfaces,” or vice versa. Also, in other embodiments, the renaming module <b>403</b> does not replace the name of the collected information, but adds additional information to the collected information. So for the example above, the “network interface” and “network interface” objects can be modified to include both values as “network interface” and “network interface.” Alternatively, the renaming module <b>403</b> may rename the collected information to include a class identifier that identifies, for example, both “network interface” and “network interface.” Alternatively, the report scanning module <b>401</b>, integration module <b>402</b>, and renaming module <b>403</b> may be used to otherwise reorganize the collected information to be separately stored in the private search database <b>121</b>, or in place of the collected information in the private search database <b>121</b>.

0098In another embodiment, the report scanning module <b>401</b>, the integration module <b>402</b>, and renaming module <b>403</b> are used to reorganize the collected information as described above, such as according to the first set of items of interests and/or according to the second set of items of interest; however, the reorganized information of this embodiment may include common terminology for similar items of the disparate information sources <b>203</b> having different terminologies.

0099In one embodiment, in order to create network topology information, information is collected from bridging tables from switches of the private LAN <b>101</b>. For example, the LAN crawler <b>111</b> is configured to access the bridging table <b>304</b> of the switch <b>310</b>, illustrated in <figref idref="DRAWINGS">FIG. 3</figref>. The LAN crawler <b>111</b> can access the bridging table <b>304</b> using SNMP, SSH protocol, or the like. In addition, the LAN crawler <b>111</b> can access information from the routing tables of the routers of the private LAN, for example, from the routing table <b>310</b> of router <b>201</b>, illustrated in <figref idref="DRAWINGS">FIG. 3</figref>. Using the information from the bridging tables and/or routing tables, information about the network topology can be created and integrated into the collected information stored in the private search database <b>121</b>. The network topology information may be separately stored in the private search database <b>121</b> for later retrieval by the user when the user wishes to analyze the network topology of the private LAN. In addition to obtaining the information from the bridging and routing tables, in another embodiment, device names may be retrieved form the DNS server using reverse DNS lookups using the IP addresses. As such, the IP addresses can be linked to the device names. The device names may also be stored in addition to, or in place of, the previously collected information stored in the private search database <b>121</b>. In another embodiment, information regarding the device types can be obtained, for example, by receiving responses to probes to open ports. Alternatively, other types of information may be collected to create the network topology information.

0100The operations of this and other flow diagrams will be described with reference to the exemplary embodiments of the other diagrams. However, it should be understood that the operations of the flow diagrams can be performed by embodiments of the invention other than those discussed with reference to these other diagrams, and the embodiments of the invention discussed with reference these other diagrams can perform operations different than those discussed with reference to the flow diagrams.

0101The techniques shown in the figures can be implemented using code and data stored and executed on one or more computers. Such computers store and communicate (internally and with other computers over a network) code and data using machine-readable media, such as machine storage media (e.g., magnetic disks; optical disks; random access memory; read only memory; flash memory devices) and machine communication media (e.g., electrical, optical, acoustical or other form of propagated signals—such as carrier waves, infrared signals, digital signals, etc.). In addition, such computers typically include a set of one or more processors coupled to one or more other components, such as a storage device, a number of user input/output devices (e.g., a keyboard and a display), and a network connection. The coupling of the set of processors and other components is typically through one or more busses and bridges (also termed as bus controllers). The storage device and network traffic respectively represent one or more machine storage media and machine communication media. Thus, the storage device of a given computer system typically stores code and data for execution on the set of one or more processors of that computer. Of course, one or more parts of an embodiment of the invention may be implemented using different combinations of software, firmware, and/or hardware.

0102<figref idref="DRAWINGS">FIG. 5</figref> illustrates an exemplary flow diagram <b>500</b> of the LAN crawler <b>111</b> of the client device <b>200</b> according to one embodiment of the invention. As described above, the LAN crawler <b>111</b> is configured to attempt to collect the descriptive information from the multiple disparate information sources <b>203</b> through a set of one or more organized questions to the devices <b>115</b> of the private LAN being crawled. In particular, the collection module <b>112</b> receives values, including descriptive information of the first set of items of interest, in response to the set of organized questions from the disparate information sources <b>203</b>. As depicted in <figref idref="DRAWINGS">FIG. 5</figref>, as part of the flow diagram <b>500</b>, the LAN crawler <b>111</b> of the client device <b>200</b> asks a first organized question <b>501</b> of a particular LAN device <b>115</b>. The LAN device <b>115</b> responds to the first organized question <b>501</b> with a first response value <b>502</b>. The LAN crawler <b>111</b> of the client device <b>200</b> then asks a second organized question <b>503</b> of the same LAN device <b>115</b> or a different LAN device <b>115</b>. The LAN device <b>115</b> response to the second organized questions <b>503</b> with a second response value <b>504</b>. The LAN crawler <b>111</b> then integrates the collected information (e.g., organized questions and corresponding response values) into a report, operation <b>505</b>, and sends the report with the collected information to the hosted on-demand search system <b>100</b>, operation <b>506</b>. As described above, the collected information in the report is implicitly organized by nature of asking organized questions and receiving the corresponding response values in response to the organized questions. In another embodiment, the LAN crawler <b>111</b> collects information in a non-organized fashion and organizes the collected information before integrating the collected information into the report at operation <b>505</b>. Also, as described above, the collected information may later be reorganized by the hosted on-demand search server <b>100</b> (e.g., reorganization module <b>126</b>).

0103In the embodiment above, two organized questions <b>501</b> and <b>503</b> were asked of one or more LAN devices <b>115</b>. In other embodiments, more or less organized questions may be asked of one or more LAN devices <b>115</b>. The reports may include one or more organized questions and corresponding value(s). In one embodiment, the reports are sent periodically over the Internet to the hosted on-demand search system <b>100</b>. In another embodiment, the reports are sent once they are integrated with a set of one or more organized questions and corresponding values. Alternatively, the reports may be sent on a scheduled basis. The collected information may be stored temporarily and independently of, or as part of the report, in memory before sending the report to the hosted on-demand search system <b>100</b>, such as in the data store <b>230</b>.

0104<figref idref="DRAWINGS">FIG. 6</figref> illustrate an exemplary flow diagram <b>600</b> of a private search according to one embodiment of the invention. As described above, the server user interface module <b>124</b> of the hosted on-demand search system <b>100</b> is configured to receive a search query from a user of the private LAN <b>101</b> to perform a private search of the corresponding private search database <b>121</b>. As part of the flow diagram <b>600</b>, the user interface <b>110</b> of the client device sends an authentication request <b>601</b> to the server user interface module <b>124</b> of the hosted on-demand search system <b>100</b>. The server user interface module <b>124</b> performs the authentication, in response to receiving the authentication request <b>601</b>, operation <b>602</b>. The server user interface module <b>124</b>, for example, may authenticate the user by looking up user's authentication information stored in the configuration database <b>125</b>. The authentication information stored in the configuration database <b>125</b> may be compared against the user authentication information sent in the authentication request <b>601</b>. If the user is not authenticated, the server user interface module <b>124</b> may send a response to the client device <b>200</b> to indicate that authentication failed (not illustrated). However, if the user is authenticated in operation <b>602</b>, the server user interface module <b>124</b> responds to the client device <b>200</b> to indicate that the authentication is granted <b>603</b>. The authentication process may occur every time a user submits a search query, or alternatively, the authentication process may occur when the user first logs on to the hosted on-demand search system <b>100</b> using the user interface <b>110</b>, for example, for each session. Although the authentication process is not necessary to receive a search query from a user, the authentication process may add additional security to the hosted on-demand search system <b>100</b>.

0105Once the user has been authenticated, the user interface <b>110</b> can receive a search query from the user, operation <b>604</b>. <figref idref="DRAWINGS">FIG. 8</figref> illustrates a search GUI <b>801</b> of a user interface page <b>800</b> on the user interface <b>110</b> that includes a first interface widget <b>802</b> to receive a search query <b>803</b> from the user, operation <b>604</b>. Once the user has typed in the search query <b>803</b>, the user may then select, or otherwise activate, a second interface widget <b>804</b>, to send the search query <b>803</b> to the hosted on-demand search system <b>100</b>, operation <b>605</b>. The server user interface module <b>124</b> receives the search query <b>803</b> and processes the search query, operation <b>606</b>. The operation <b>606</b> may include sending the search query <b>803</b> to the database interface <b>122</b> to perform a private search in the corresponding search database <b>121</b> that corresponds to the private LAN from which the user originated the search request. The database interface <b>122</b> returns the search results to the server user interface module <b>124</b>. The server user interface module <b>124</b> may generate the user interface page <b>800</b>, including include the search results <b>805</b>, for the search GUI <b>801</b>. The server user interface module <b>124</b> sends the generated user interface page <b>800</b>, including the search results <b>805</b>, to the client device <b>200</b> to be displayed, operation <b>607</b>. The client device <b>200</b> then displays the user interface page <b>800</b>, including the search results <b>805</b>, as part of the search GUI <b>801</b>, operation <b>608</b>. In one embodiment, the search results <b>805</b> are displayed to look like search results from typical web search engines, such as with a small snippet of information including the context for the matching fields. Alternatively, the search results <b>805</b> may be displayed in other ways.

0106In one embodiment, the search query <b>803</b> is used to retrieve aggregate values, such as the number of devices <b>115</b> which are in a wireless access point class (e.g., “wifi_ap”). In another embodiment, the search query <b>803</b> is used to retrieve exact matches based on structure, for example, finding all devices on which a particular software application has been installed. This may be useful in knowing how many licenses of the particular software applications are being used on the private LAN, such as for software licensing audits, or the like. In another embodiment, the search query is used to retrieve matches of similar items that use different terminology. In another embodiment, the search query can be modified to refine a search, such as by clicking on aspects of a search result to refine the search, or to focus on the detailed information about the resource found.

0107In one embodiment, the search query <b>803</b> can be designated as shareable with other users, even users outside of the private LAN in which the user is conducting the private search. As illustrated in <figref idref="DRAWINGS">FIG. 8</figref>, the search GUI <b>801</b> includes a third interface widget <b>806</b> that allows a user to designate the search query <b>803</b> as shareable. Once the user has designated the search query <b>803</b> as shareable, when the user selects, or otherwise activates the second interface widget, the designation information is sent with the search query <b>803</b> to the server user interface module <b>124</b>. The server user interface module <b>124</b> stores the saved search query <b>803</b> in the configuration database <b>125</b> for later retrieval by the user or by other uses in, or outside, the private LAN. It should be noted that the server user interface module <b>124</b> is configured to store the search query <b>803</b> when designated as shareable, but not the search results <b>805</b>. By designating the search query <b>803</b> as shareable, the server user interface module <b>124</b> is able to allow display and selection of the stored search query <b>803</b> by another user, for example, users of a different private LAN. In another embodiment, additional interface widgets may be used, such as, for example, one to designate a search query as shareable with the user's colleagues, another to designate a search query as shareable with a community, and another to designate a search query as shareable with the public. Once the interface widgets have been selected, another interface widget can be selected to save the search query or queries.

0108Although the embodiment above describes sending the search query <b>803</b> that is received from the user in operation <b>604</b>, alternatively, the search query that is sent in operation <b>605</b> may also be a saved search query that is stored on the client device <b>200</b>. Alternatively, instead of sending the search query <b>803</b> in operation <b>605</b>, the client device <b>200</b> may send a request to perform a private search based on a saved search query that is stored on the hosted on-demand search system <b>100</b>.

0109In one embodiment, as illustrated in <figref idref="DRAWINGS">FIG. 8</figref>, the user interface <b>110</b> may display a user interface page <b>850</b> that includes a dashboard GUI <b>851</b>. As described above, a dashboard is a GUI widget that can be part of the user interface page <b>850</b>, and can be configured and saved by the user to display search results in various forms for saved search queries. For example, the user interface page <b>850</b> includes three dashboard panels <b>860</b>, <b>870</b>, and <b>880</b>. The first panel <b>860</b> includes the saved search query <b>861</b>, and displays the updated search results <b>862</b> in the form of a list when the dashboard GUI <b>851</b> is refreshed (e.g., when the user first accesses the dashboard and/or periodically thereafter). The second panel <b>870</b> includes the saved search query <b>871</b>, and displays the updated search results <b>872</b> in the form of a chart when the dashboard GUI <b>851</b> is refreshed. The third panel <b>880</b> includes the saved search query <b>881</b>, and displays the updated search results <b>882</b> in the form of a table when the dashboard GUI <b>851</b> is refreshed. Each of the dashboard panels <b>860</b>, <b>870</b>, and <b>880</b> may include updated search results for separate saved search queries, or alternatively, for the same search queries.

0110As described above, the collection of dashboard panels <b>860</b>, <b>870</b>, and <b>880</b> may include saved configurations of the dashboard (e.g., search queries, such as the placement on the dashboard panels on the dashboard GUI, the number of search results to display, the form to display the search results, or the like). These configurations may be stored for each user on the multiple private LANs. In one embodiment, the dashboard configuration of the dashboard GUI <b>851</b> can be designated as shareable to be shared with users of the same or different private LANs. For example, the dashboard GUI <b>851</b> may include an interface widget <b>852</b>, which when selected, or otherwise activated, designates the dashboard to be shareable. The dashboard configuration may be saved locally on the client device <b>200</b> (e.g., in data store <b>230</b>), and/or sent to the hosted on-demand search system <b>100</b> to be stored in the configuration database <b>125</b> for later retrieval by the user and/or users of the same or different private LANs. In one embodiment, the user may save the dashboard configuration with a saved search query so that when the user logs in, the dashboard GUI <b>851</b> is displayed with updated search results for the saved search query without having to manually enter the search query again.

0111Although the embodiment above includes a single interface widget <b>852</b> to designate the dashboard configuration of the dashboard GUI <b>851</b>, in other embodiments, the configurations of the dashboard panels <b>860</b>, <b>870</b>, and <b>880</b>, can be individually or collectively saved for later retrieval by the user and/or other users of the same private LAN or different private LANs.

0112<figref idref="DRAWINGS">FIG. 7</figref> illustrates an exemplary flow chart of a method <b>700</b> of operations between the client device <b>200</b> and the hosted on-demand search system <b>100</b> according to one embodiment of the invention. The method <b>700</b> may start with a user on the client device <b>200</b> requesting the LAN crawler <b>111</b> from the hosted on-demand search system <b>100</b>. This request may be made by the user through an Internet browser, or otherwise, to the distribution module <b>127</b> of the server user interface module <b>124</b>. For example, the user, visiting a website hosted by the company or organization that manages the hosted on-demand search system <b>100</b>, may click on a link to download the LAN crawler <b>111</b> to the client device <b>200</b>. The LAN crawler <b>111</b> may also be provided in other forms, such as on a compact disc, or the like.

0113On the client side, the user then installs the LAN crawler <b>111</b> on the client device <b>200</b> of the private LAN <b>101</b>, operation <b>701</b>. As described above, the LAN crawler <b>111</b> automatically and repeatedly collects private data stored on the devices <b>115</b> of the private LAN <b>101</b> using the LAN crawler <b>111</b>, operation <b>702</b>; automatically organizes the collected information, operation <b>703</b>; and automatically reports the organized information to the hosted on-demand search system <b>100</b>, operation <b>704</b>. As described above, the LAN crawler <b>111</b> may collect from multiple disparate information sources, only those parts of the disparate information sources that include descriptive information of the first set of items of interest. These items of interests may be collected from the multiple disparate information sources <b>203</b>. Also, the LAN crawler <b>111</b> may be configured to organize the collected information by using organized questions. The LAN crawler <b>111</b> may also organize the collected information using the organization module <b>114</b>. After the user has installed the LAN crawler <b>111</b> and the LAN crawler <b>111</b> has started to report the collected information to the hosted on-demand search system <b>100</b>, the user requests the user interface <b>110</b> from the hosted on-demand search system <b>100</b>, operation <b>705</b>. This may be done by the user accessing a website and logging into an account using a username and password. Alternatively, the user may request the user interface <b>110</b> in other ways, such as launching an application that requests and displays the user interface <b>110</b>.

0114On the server side, the hosted on-demand search system <b>100</b> receives the reports from the client device <b>200</b>, operation <b>706</b>. Based on the received reports, the hosted on-demand search system <b>100</b> creates and synchronizes a private search database <b>121</b>, operation <b>707</b>. The hosted on-demand search system <b>100</b>, upon request (e.g. operation <b>705</b>), provides the user interface <b>1110</b>, such as the search GUI <b>801</b>, to the client device <b>200</b>, operation <b>708</b>. The user interface <b>110</b> allows the user to perform one or more private searches of the private search database <b>121</b>.

0115In one embodiment, once the LAN crawler <b>111</b> has been installed, the operations <b>702</b>-<b>704</b> on the client side, and operation <b>706</b> and <b>707</b> on the server side may be performed automatically and repeatedly. For example, the LAN crawler <b>111</b> may be configured to automatically and repeatedly collect the private data from devices <b>115</b> of the private LAN <b>101</b>. This may be configured to be periodic at scheduled intervals, to be continuous, to be only in response to discovery of new devices <b>115</b> on the private LAN, or the like. In another embodiment, once the LAN crawler <b>111</b> has been installed, the operations <b>702</b>-<b>704</b> may be performed manually in response to a user request.

0116On the client side, using the provided user interface <b>110</b>, the client device <b>200</b> receives a search query from a user, operation <b>709</b>. For example, the user may type in a search query <b>803</b> in the first interface widget <b>802</b>. Alternatively, the user may select a saved search query <b>803</b>, such as from a drop-down list of saved searches. The drop-down list may include search queries that are already included in the hosted on-demand search system <b>100</b>, search queries that the user has previously saved, search queries that user's colleagues has previously saved, search queries that have been previously saved by the community, or the like. The user may designate the search query as shareable to be shared with other users, including users of other private LANs, operation <b>710</b>. The user may designate the search query <b>803</b> by selecting the third interface widget <b>806</b>, which may be a check box, a radio button, or the like. Alternatively, the user may chose to not designate the search query <b>803</b> as shareable, keeping the search query <b>803</b> private to the private LAN <b>101</b>. The user then selects, or otherwise activates, the second interface widget <b>804</b>, which sends the search query to the hosted on-demand search system <b>100</b>, operation <b>711</b>.

0117On the server side, the hosted on-demand search system <b>100</b> receives the search query from the client device <b>200</b> to search the private search database, operation <b>712</b>. The hosted on-demand search system <b>100</b> performs a private search in the corresponding private search database <b>121</b> using the search query, operation <b>713</b>. The hosted on-demand search system <b>100</b> returns the search results of the private search to the client device <b>200</b> in a user interface page, operation <b>714</b>. For example, the hosted on-demand search system <b>100</b> generates the user interface page <b>800</b> that includes the search results <b>805</b> and sends the generated page to the client device <b>200</b> to be displayed. The hosted on-demand search system <b>100</b> also stores the search query, for example, in the configuration database <b>125</b>, operation <b>715</b>.

0118On the client side, the client device <b>200</b> receives the generated user interface page with the search results and displays the user interface page to the user, operation <b>716</b>. The user may then review the search results, modify the search query to perform an additional search, search for additional items within the search results, type in another search query, save the search query, or the like. The user may also designate the search query as shareable after the user has received the search results. For example, the user may select the third interface widget <b>806</b> to designate the search query <b>803</b> as shareable. The user interface may send a request to the hosted on-demand search system <b>100</b> to modify the saved search query <b>803</b>, which was previously stored in the configuration database <b>125</b>, to be designated as shareable, instead of private.

0119Although the operations of <figref idref="DRAWINGS">FIG. 7</figref> have been described and illustrated as performing a private search in response to a search query received from a user, in other embodiments, private searches may be performed in response to saved search queries, such as saved search queries of a dashboard GUI. For example, upon launching the dashboard GUI <b>851</b>, the client device <b>200</b> sends the saved search queries <b>861</b>, <b>871</b>, and <b>881</b> to the hosed on-demand search system <b>100</b>, performs the corresponding private searches using the search queries <b>861</b>, <b>871</b>, and <b>881</b>, returning the updated search results <b>862</b>, <b>872</b>, and <b>882</b> to be displayed in the dashboard panels <b>860</b>, <b>870</b>, and <b>880</b>, respectively. Also, the dashboard panels <b>860</b>, <b>870</b>, and <b>880</b> or the dashboard GUI <b>851</b> may be designated as shareable (e.g., selecting the interface widget <b>852</b>). The user interface may send a request to the hosted on-demand search system <b>100</b> to save, and designated as shareable, the dashboard configurations in the configuration database <b>125</b> for later retrieval by the user and other uses, including users of other private LANs. The configuration of the dashboard panels <b>860</b>, <b>870</b>, and <b>880</b> or the dashboard GUI <b>851</b> may be modified before or after the private searches have been performed. If performed after the private searches have been performed, an additional request may be sent to designate the previously saved dashboard configuration as shareable.

0120<figref idref="DRAWINGS">FIG. 9</figref> illustrates an exemplary embodiment of a private search database that is a hierarchical database that stores the collected information in a tree structure according to one embodiment of the invention. In <figref idref="DRAWINGS">FIG. 9</figref>, the data of hierarchical database <b>110</b> is organized into a tree structure. Each data element (i.e., not a value) on the tree is a node of the tree. Each node on the tree has a corresponding unique identifier (e.g., a node identifier). For example, network node <b>902</b> has a unique identifier of two. At the top of the tree structure is the root node <b>900</b> of the tree, which is represented by the symbol /. The node can be described by a unique path, where each branch of the tree corresponds to a slash (/) in the path. For example, the path may be /network/device/interface/name. Directly below the root node exists two child nodes, network <b>902</b> and directory <b>972</b>. A child node is a node, not a value, that itself descends from a node (e.g., a parent node or root node). Each parent node can have many child nodes, but each child node only has one parent. A child node may also be a parent node. For example, network <b>902</b> and directory <b>972</b> each are parent nodes in addition to being child nodes because they include one or more child nodes.

0121In addition, network <b>902</b> and directory <b>972</b> are each root nodes of a sub-tree. A sub-tree is a subset of the tree. A sub-tree includes information starting at the sub-tree root node and traversing through each child node of the sub-tree root node and ending with at least one value. Any node on the tree that itself has nodes below it (e.g., a parent node) can be referred to as a sub-tree root node. Thus, each sub-tree may include other sub-trees (i.e., the sub-trees may be nested within a sub-tree). There are many sub-trees in <figref idref="DRAWINGS">FIG. 9</figref>. For example as previously described, a sub-tree where network <b>902</b> is the sub-tree root node includes all the information, including values, from the nodes device <b>904</b>, device <b>906</b> (which includes the node manufacturer <b>928</b>), and device <b>908</b>. As an example of a nested sub-tree, device <b>904</b> is a sub-tree root node for the sub-tree that includes all the information, including values, from the nodes manufacturer <b>910</b>, interface <b>912</b>, and interface <b>914</b>. The interface <b>912</b> node includes the MAC Address <b>916</b>, Name <b>918</b>, Status <b>920</b>, and the interface <b>914</b> node includes MAC Address <b>922</b>, name <b>924</b>, and Status <b>926</b>. As another example of a nested sub-tree, device <b>908</b> is a sub-tree root node for the sub-tree that includes all the information, including values, from the nodes interface <b>930</b>, interface <b>936</b>, manufacturer <b>944</b>, names <b>932</b>, <b>934</b>, <b>938</b>, and status <b>940</b>. As another example of a nested sub-tree, the directory <b>972</b> includes the nodes users <b>974</b> and users <b>976</b>, which include the nodes name <b>978</b> and names <b>980</b>, respectively.

0122Values are associated with leaf nodes. For example, the node manufacturer <b>910</b> is a leaf node because it is associated with the value <b>910</b> ‘Dell Corporation’. While in one embodiment of the invention values are only associated with leaf nodes, in alternative embodiments of the invention any node in the hierarchy can have values associated with that node.

0123In one embodiment, the LAN crawler <b>111</b> collects information about the private LAN being crawled (e.g., network assets) and sends it to the hosted on-demand search system to be stored in the private search database, which stores the data in a tree-structured format. As illustrated in <figref idref="DRAWINGS">FIG. 9</figref>, the collected information is visually represented in an inverted tree structure with the root at the top, and each data element as a node on the tree. The hierarchical database is useful because it provides the flexibility to scale and the ability to group related information and display the relationships.

0124The hierarchical database provides the ability to provide quantitative answers to questions, such as questions regarding IT information of a private LAN. The LAN crawler <b>111</b> collects information in an organized manner that lends itself to be stored in a tree structure. The hierarchical database may maintain the organization or structure of the information collected by the LAN crawler <b>111</b>. For example, if you search the private search database for ‘Tetris’, a full-text search algorithm finds every instance of ‘Tetris’, including a computer named ‘Tetris’ and a software program named ‘Tetris.’ Because the LAN crawler knows how it collected the information for each, including how to identify the computer which has the name, and the network to which that computer belongs, and the identity of the computer which has the software installed, this organization can be maintained in the private search database using a hierarchical database. Using the hierarchical database, the hosted on-demand search system can know the difference between the computer named ‘Tetris’ and a software program named ‘Tetris,’ because of the relationships between the computer and the software in the hierarchical database.

0125As many database users are familiar with SQL, according to one embodiment of the invention the hierarchical database is searched with a query syntax that is familiar to SQL uses. For example, <figref idref="DRAWINGS">FIG. 10</figref> illustrates exemplary search syntaxes for searching a hierarchical database according to one embodiment of the invention. For example a simple hierarchical database search query syntax may take the form of SELECT * FROM /Network. Similarly to SQL, the SELECT clause in the query is used to specify the data returned subject to the FROM clause. In the above simple example, the asterisk indicates that everything in the hierarchical database is to be returned subject to the FROM clause (e.g., the network node). In the case of a tree, everything in the tree will be returned subject to the FROM clause. Also similar to SQL, the FROM clause describes from where in the database information should be returned. In the case of a tree, the FROM clause represents which sub-tree the data will be searched from. Also similar to SQL, a WHERE clause may be used to specify the selection. In other words, the WHERE clause restricts or filters the data returned. An example of a search query with a WHERE clause is SELECT * FROM /Network/Device WHERE Interface/Name=‘eth0’. It should be understood that the above search syntaxes are exemplary and that many other syntaxes as known in the art to search a hierarchical database may be used.

0126According to another embodiment of the invention, the private search database illustrated as a hierarchical database in <figref idref="DRAWINGS">FIG. 9</figref> also may be used to gene data in an unstructured database (e.g., an inverted index, a forward index, a trie, a vector space model, etc.). For example, virtual documents may be created from the hierarchical database. A virtual document is used to refer to representation of data as textual data that may be indexed into an unstructured database. Referring to <figref idref="DRAWINGS">FIG. 9</figref>, the virtual documents that are created are represented by the dashed lines. Once virtual documents are created, the unstructured database and the hierarchical database may be searched with a single search query to allow keyword based searching of the unstructured database while retaining the searching of the hierarchical database. For example, the single search query may take the form of SELECT * FROM %Dell% where the unstructured search string % Dell % is used to search the unstructured database (e.g., the virtual documents within the unstructured database) for the string ‘dell’. As there are two virtual documents that include the term ‘Dell’, both of the sub-trees representing those virtual documents are returned as a result.

0127For example in one embodiment of the invention the data stored in a hierarchical database includes information regarding substantially all devices within a private LAN, a list of software installed on those devices, and a list of users authorized to use those devices. Additionally, the data stored may include information regarding the operating system version installed on substantially all devices within the private LAN, the software which is running on substantially all devices within the private LAN, and a configuration file from at least one router, switch, or firewall within the private LAN. The devices may include substantially all workstations within a private LAN, substantially all routers within the private LAN, substantially all switches within the private LAN, substantially all servers within the private LAN, substantially all firewalls within the private LAN, and substantially all directory servers within the private LAN.

Another Embodiment of the Invention

0128Having described embodiment(s) of the invention, alternative embodiment(s) will now be described. Like the previous embodiment(s), these alternative embodiment(s) allow for hosted searching of information. However, unlike the previous embodiment(s), these embodiment(s) allow for hosted searching information for information that is not limited to private LAN information, as described above, but may include other types of information, such as financial information, enterprise information, traffic statistics from web-sites, transaction statistics from a database system, trading volumes from a stock trading application, resource usage and resource availability in a MRP system or a Enterprise Resource Planning (ERP) system, sales forecast information from a customer relationship management (CRM) system, or the like.

Alternative Embodiments

0129While embodiments of the invention has been described in relation to collecting private LAN information stored on devices of a private LAN, such as technical information from devices of the private LAN, other embodiments may include collecting other types of information, as described above, from other types of information sources on devices of public networks, private and public networks, or the like. Therefore, embodiments of the invention are not limited to collecting private LAN information. In addition, while embodiments of the invention have been described in relation to technical information stored in devices of the private LAN, alternative embodiments could be implemented such that other types of information may be collected from information sources of devices of public networks, private and public networks, or the like. Such an embodiment could be implemented by having the LAN crawler ask one or more questions of the devices to collect the other types of information.

0130For example, while the flow diagrams in the figures show a particular order of operations performed by certain embodiments of the invention, it should be understood that such order is exemplary (e.g., alternative embodiments may perform the operations in a different order, combine certain operations, overlap certain operations, etc.)

0131While the invention has been described in terms of several embodiments, those skilled in the art will recognize that the invention is not limited to the embodiments described, can be practiced with modification and alteration within the spirit and scope of the appended claims. The description is thus to be regarded as illustrative instead of limiting.